Page MenuHomeVyOS Platform

add package nftables
Closed, ResolvedPublicFEATURE REQUEST


vyos doesn't have nft command.
It can be interesting if you want to create your own rules with nft instead of old iptables suite.



Difficulty level
Unknown (require assessment)
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

elbuit created this task.Nov 16 2019, 5:18 PM
c-po added a subscriber: c-po.EditedNov 16 2019, 6:42 PM

I guess we will make use of nftables when the firewall codebase is rewritten. That rewrite is a major effort and on the roadmap - but it does not have momentum/priority yet due to limited resources.

Would like to contribute?

syncer triaged this task as Wishlist priority.Nov 16 2019, 9:57 PM

wow christian, to move from iptables to nftables is not a small project.
As far I remember vyos has a quite complex iptables chains.
Bu in fact, I'm quite disconnected from vyos.

I would like to help if I had some free time, but something small.

Rolling is support nft now.

vyos@mpls:~$ sudo nft -v
nftables v0.9.0 (Fearless Fosdick)

There are examples and descriptions that you would like to see in the system?

Thanks @Viacheslav, I've build a custom vyos 1.2.4 with nftables package because I want to add custom rules in nftables mode.

Rolling uses a iptables - nftables wrapper that converts iptables to nft, but I think that firewall needs to be rewritten from zero, and clean it. There are other sections that depends on iptables (ie: flow accounting, connection tracking,..)

The think I like of nftables is "compiled" before be applied, and if "compilation" fails ruleset won't be applied ( That is quite similar to FreeBSD pf)
For that, to convert all vyos rules to a nft file and then compile and apply it could be an acceptable implementation, even if you only add a single rule.

If compilation works it applies new ruleset, if not, previous ruleset is maintained.

That implementation is not as complicated as we have now in current vyos, and most of it could be done with a jinja2 template.


vyos@mpls# sudo nft list table nat
table ip nat {
		type nat hook prerouting priority -100; policy accept;
		counter packets 0 bytes 0 jump VYATTA_PRE_DNAT_HOOK

	chain INPUT {
		type nat hook input priority 100; policy accept;

		type nat hook postrouting priority 100; policy accept;
		counter packets 0 bytes 0 jump VYATTA_PRE_SNAT_HOOK

	chain OUTPUT {
		type nat hook output priority -100; policy accept;

		counter packets 0 bytes 0 return

		counter packets 0 bytes 0 return

Let us know if you need help.

pasik added a subscriber: pasik.May 19 2020, 8:05 PM
c-po added a comment.Jun 25 2020, 6:21 PM

Latest rolling has nftables 0.9.6 - closing this

c-po closed this task as Resolved.Jun 25 2020, 6:21 PM
c-po claimed this task.
c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus board.Mon, Aug 3, 3:27 PM